import "../../options-B5K8QEV1.mjs";
import "../../types-BCOU_CXE.mjs";
import "../../types-XJPFqvc1.mjs";
import "../../authz-cKSuylYa.mjs";
import "../../index-HRJ8DhHY.mjs";
import "../../runner-Bnq68jCZ.mjs";
import "../../index-BFUET8yL.mjs";
import "../../types-C2avdenh.mjs";
import "../../hreflang-BktsQIF_.mjs";
import "../../validate-3945fzPI.mjs";
import { EmDashHandlers } from "../types.mjs";
import { Kysely } from "kysely";
import { EffectiveGrants, User } from "@premium-cms/auth";
import * as astro from "astro";

//#region src/auth/authz.d.ts
interface ResolvedRole {
  id: string;
  slug: string;
  name: string;
  level: number;
  builtin: boolean;
}
interface RequestAuthz {
  /** The user with `authz` attached — assign this to `locals.user`. */
  user: User;
  role: ResolvedRole | null;
  /** What this request may do. For tokens, already clamped to the owner. */
  grants: EffectiveGrants;
  /** The owner's own grants — identical to `grants` for session auth. */
  ownerGrants: EffectiveGrants;
  /** Slugs of the policies the owner's role holds. */
  rolePolicies: readonly string[];
}
//#endregion
//#region src/astro/middleware/auth.d.ts
declare global {
  namespace App {
    interface Locals {
      user?: User;
      /** Token scopes when authenticated via API token or OAuth token. Undefined for session auth. */
      /** Set when the request authenticated with a Bearer token (API token or OAuth). */
      tokenAuth?: boolean;
      /** Set when the Bearer token's row opts into CORS (middleware/cors.ts reflects the Origin). */
      tokenCors?: boolean;
      /**
       * Policy slugs carried by a policy-based API token. Null for a legacy
       * scoped token or an OAuth token; undefined for session auth.
       */
      tokenPolicies?: string[] | null;
      /** Resolved role and grants for the authenticated principal. */
      authz?: RequestAuthz;
      emdash?: EmDashHandlers;
    }
    interface SessionData {
      user: {
        id: string;
      };
      hasSeenWelcome: boolean;
    }
  }
}
declare const onRequest: astro.MiddlewareHandler;
//#endregion
export { onRequest };
//# sourceMappingURL=auth.d.mts.map